Analysis

  • max time kernel
    131s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 08:21

General

  • Target

    82e337bbbd9ed64906d0930e2fdc29a708f9c7bfb954c019665da5cf6d14b4e0.exe

  • Size

    798KB

  • MD5

    cae600b2915b9fa9e4d434165847e94d

  • SHA1

    1c2a32fd7219149a17000f8205622139daf0af83

  • SHA256

    82e337bbbd9ed64906d0930e2fdc29a708f9c7bfb954c019665da5cf6d14b4e0

  • SHA512

    a353bdf3f195eeb66c15d510bf1322ac5fa33cf2e7d1a0ea88a97a872bc6fc9cc7afd52d64fe0df8a8b365d0fa99266670609d6996c5b099111a7908b6b827fd

  • SSDEEP

    12288:yMrYy907ajmawoV3W6EIqdghGSwsYDcv4DjovcYcj1zIXX3dQpDXx1oN/vn:CyMZaFV7NHYn44mVszaX3daDXzY/vn

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82e337bbbd9ed64906d0930e2fdc29a708f9c7bfb954c019665da5cf6d14b4e0.exe
    "C:\Users\Admin\AppData\Local\Temp\82e337bbbd9ed64906d0930e2fdc29a708f9c7bfb954c019665da5cf6d14b4e0.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kpY58OG.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kpY58OG.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kex71Sr.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kex71Sr.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dUK42Ea.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dUK42Ea.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kpY58OG.exe

    Filesize

    694KB

    MD5

    a89bfab0ac8d30a956df483f5811996b

    SHA1

    c0a8286f27c07c94463769e757c4936b928bfbbb

    SHA256

    0cfbed1996a3f90c7d59c4cad9655be441202e9e8bcc260ec37ff2012bc0cb9f

    SHA512

    3fe24784b3e9c467c682730a1d591311dec15220861d0119fa027becd2d01a617cc9e2a31c55caadf822fd895d8ce11d585d37cef6727915c021eccd9735a31e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kex71Sr.exe

    Filesize

    507KB

    MD5

    e14479ec6ca0b2c9f76c82c62882eb2c

    SHA1

    135428801d34ce83fdb74363b335bc2ab675125f

    SHA256

    517e3a0ea49961c8a815aa245fbe57f7e282ab12ace2ff08a85c911773a3ce4a

    SHA512

    ed5107e1ccf15eef2f6a09c27d378e39adb09c05c4e9cace6994a99ee6e27b446c534448ed7b40aa6ff4f07cdf789bde48455b1f425603d2c18958aa802172f4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dUK42Ea.exe

    Filesize

    175KB

    MD5

    da6f3bef8abc85bd09f50783059964e3

    SHA1

    a0f25f60ec1896c4c920ea397f40e6ce29724322

    SHA256

    e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

    SHA512

    4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

  • memory/4532-21-0x0000000000030000-0x0000000000062000-memory.dmp

    Filesize

    200KB

  • memory/4532-22-0x0000000004FA0000-0x00000000055B8000-memory.dmp

    Filesize

    6.1MB

  • memory/4532-23-0x0000000004B10000-0x0000000004C1A000-memory.dmp

    Filesize

    1.0MB

  • memory/4532-24-0x0000000004A40000-0x0000000004A52000-memory.dmp

    Filesize

    72KB

  • memory/4532-25-0x0000000004AA0000-0x0000000004ADC000-memory.dmp

    Filesize

    240KB

  • memory/4532-26-0x0000000004C20000-0x0000000004C6C000-memory.dmp

    Filesize

    304KB